mambax7 /
xoops-martin
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | /** |
||
| 4 | * @处理用户中心 |
||
| 5 | * @license http://www.blags.org/ |
||
| 6 | * @created :2010年07月14日 21时54分 |
||
| 7 | * @copyright 1997-2010 The Martin Group |
||
| 8 | * @author Martin <[email protected]> |
||
| 9 | * */ |
||
| 10 | class MartinMember extends XoopsObject |
||
| 11 | { |
||
| 12 | } |
||
| 13 | |||
| 14 | /** |
||
| 15 | * @处理用户中心 |
||
| 16 | * @method: |
||
| 17 | * @license http://www.blags.org/ |
||
| 18 | * @created :2010年07月14日 21时54分 |
||
| 19 | * @copyright 1997-2010 The Martin Group |
||
| 20 | * @author Martin <[email protected]> |
||
| 21 | * */ |
||
| 22 | class MartinMemberHandler extends XoopsObjectHandler |
||
| 23 | { |
||
| 24 | /** |
||
| 25 | * @create cart object |
||
| 26 | * @license http://www.blags.org/ |
||
| 27 | * @created :2010年07月04日 12时59分 |
||
| 28 | * @copyright 1997-2010 The Martin Group |
||
| 29 | * @author Martin <[email protected]> |
||
| 30 | * */ |
||
| 31 | public function &create() |
||
| 32 | { |
||
| 33 | $obj =& new MartinMember; |
||
| 34 | |||
| 35 | return $obj; |
||
| 36 | } |
||
| 37 | |||
| 38 | /** |
||
| 39 | * @get rows |
||
| 40 | * @license http://www.blags.org/ |
||
| 41 | * @created :2010年06月20日 13时09分 |
||
| 42 | * @copyright 1997-2010 The Martin Group |
||
| 43 | * @author Martin <[email protected]> |
||
| 44 | * @param $sql |
||
| 45 | * @param null $key |
||
| 46 | * @return array |
||
| 47 | */ |
||
| 48 | View Code Duplication | public function GetRows($sql, $key = null) |
|
| 49 | { |
||
| 50 | global $xoopsDB; |
||
| 51 | $result = $xoopsDB->query($sql); |
||
| 52 | $rows = array(); |
||
| 53 | while ($row = $xoopsDB->fetchArray($result)) { |
||
| 54 | if (is_null($key)) { |
||
| 55 | $rows[] = $row; |
||
| 56 | } else { |
||
| 57 | $rows[$row[$key]] = $row; |
||
| 58 | } |
||
| 59 | } |
||
| 60 | |||
| 61 | return $rows; |
||
| 62 | } |
||
| 63 | |||
| 64 | /** |
||
| 65 | * @add memeber favorite hotel |
||
| 66 | * @method: |
||
| 67 | * @license http://www.blags.org/ |
||
| 68 | * @created :2010年07月18日 12时16分 |
||
| 69 | * @copyright 1997-2010 The Martin Group |
||
| 70 | * @author Martin <[email protected]> |
||
| 71 | * @param $uid |
||
| 72 | * @param $hotel_id |
||
| 73 | * @return |
||
| 74 | */ |
||
| 75 | public function AddFavorite($uid, $hotel_id) |
||
|
0 ignored issues
–
show
|
|||
| 76 | { |
||
| 77 | $sql = "INSERT INTO {$this->db->prefix("martin_user_favorite")} (uid,hotel_id) VALUES ($uid,$hotel_id)"; |
||
| 78 | |||
| 79 | return $this->db->query($sql); |
||
| 80 | } |
||
| 81 | |||
| 82 | /** |
||
| 83 | * @ |
||
| 84 | * @method: |
||
| 85 | * @license http://www.blags.org/ |
||
| 86 | * @created :2010年07月18日 12时16分 |
||
| 87 | * @copyright 1997-2010 The Martin Group |
||
| 88 | * @author Martin <[email protected]> |
||
| 89 | * @param $start |
||
| 90 | * @param bool $isLived |
||
| 91 | * @return array |
||
| 92 | */ |
||
| 93 | public function GetHotelList($start, $isLived = false) |
||
| 94 | { |
||
| 95 | $rows = array(); |
||
| 96 | global $xoopsUser, $xoopsDB, $xoopsModuleConfig, $search_handler, $hotel_handler; |
||
| 97 | $uid = $xoopsUser->uid(); |
||
| 98 | if ($isLived) { |
||
| 99 | $order_table = $xoopsDB->prefix('martin_order'); |
||
| 100 | $sql_str = "SELECT r.hotel_id FROM {$xoopsDB->prefix("martin_room")} r WHERE r.room_id IN |
||
| 101 | ( |
||
| 102 | SELECT oqr.room_id FROM {$xoopsDB->prefix("martin_order_query_room")} oqr |
||
| 103 | WHERE order_id IN |
||
| 104 | (SELECT o.order_id FROM $order_table o WHERE o.order_uid = $uid AND o.order_status = 14) |
||
| 105 | UNION |
||
| 106 | SELECT mor.room_id FROM {$xoopsDB->prefix("martin_order_room")} mor |
||
| 107 | WHERE order_id IN |
||
| 108 | (SELECT o.order_id FROM $order_table o WHERE o.order_uid = $uid AND o.order_status = 14) |
||
| 109 | )"; |
||
| 110 | } else { |
||
| 111 | $sql_str = "SELECT f.hotel_id FROM {$xoopsDB->prefix("martin_user_favorite")} f WHERE f.uid = $uid"; |
||
| 112 | } |
||
| 113 | |||
| 114 | //总数 |
||
| 115 | $sql_count = str_replace("r.hotel_id", "count(*) as count", $sql_str); |
||
| 116 | $sql_count = str_replace("f.hotel_id", "count(*) as count", $sql_count); |
||
| 117 | list($rows['count']) = $xoopsDB->fetchRow($xoopsDB->query($sql_count)); |
||
| 118 | |||
| 119 | $sql = "SELECT h.hotel_id,h.hotel_alias,h.hotel_city,h.hotel_name,h.hotel_city_id |
||
| 120 | FROM {$xoopsDB->prefix("martin_hotel")} h WHERE h.hotel_id IN (%s) "; |
||
| 121 | $sql .= "GROUP BY hotel_id ORDER BY h.hotel_rank ASC "; |
||
| 122 | $sql .= "LIMIT $start,{$xoopsModuleConfig['front_perpage']}"; |
||
| 123 | $sql = sprintf($sql, $sql_str); |
||
| 124 | //echo $sql; |
||
| 125 | $hotels = $this->GetRows($sql, 'hotel_id'); |
||
| 126 | $hotelAlias = $search_handler->GetCityAlias(); |
||
| 127 | $cityList = $hotel_handler->getCityList(); |
||
| 128 | if (is_array($hotels)) { |
||
| 129 | foreach ($hotels as $key => $value) { |
||
| 130 | $city_ids = explode(",", $value['hotel_city_id']); |
||
| 131 | foreach ($city_ids as $id) { |
||
| 132 | $city_name[] = $cityList[$id]; |
||
| 133 | } |
||
| 134 | $value['hotel_city_id'] = implode("、", $city_name); |
||
| 135 | $value['hotel_city_alias'] = XOOPS_URL . '/hotel/' . $hotelAlias[$value['hotel_city']]; |
||
| 136 | $value['url'] = XOOPS_URL . '/hotel/' . $hotelAlias[$value['hotel_city']] . '/' . $value['hotel_alias'] . $xoopsModuleConfig['hotel_static_prefix']; |
||
| 137 | $value['hotel_city'] = $cityList[$value['hotel_city']]; |
||
| 138 | $rows[] = $value; |
||
| 139 | unset($value, $city_name); |
||
| 140 | } |
||
| 141 | } |
||
| 142 | unset($hotelAlias, $cityList); |
||
| 143 | |||
| 144 | return $rows; |
||
| 145 | } |
||
| 146 | |||
| 147 | /** |
||
| 148 | * @ |
||
| 149 | * @method: |
||
| 150 | * @license http://www.blags.org/ |
||
| 151 | * @created :2010年07月18日 12时16分 |
||
| 152 | * @copyright 1997-2010 The Martin Group |
||
| 153 | * @author Martin <[email protected]> |
||
| 154 | * @param $start |
||
| 155 | * @return array |
||
| 156 | */ |
||
| 157 | public function GetCouponList($start) |
||
| 158 | { |
||
| 159 | $rows = array(); |
||
| 160 | global $xoopsUser, $xoopsDB, $xoopsModuleConfig, $search_handler, $hotel_handler; |
||
| 161 | $table = $xoopsDB->prefix("martin_user_coupon"); |
||
| 162 | $uid = $xoopsUser->uid(); |
||
| 163 | $sql = "SELECT count(*) as count FROM $table WHERE uid = $uid"; |
||
| 164 | list($rows['count']) = $xoopsDB->fetchRow($xoopsDB->query($sql_count)); |
||
| 165 | |||
| 166 | $sql = "SELECT c.*,h.hotel_name FROM $table c |
||
| 167 | LEFT JOIN {$xoopsDB->prefix("martin_order")} o ON (c.relation_id = o.order_id) |
||
| 168 | LEFT JOIN {$xoopsDB->prefix("martin_order_room")} mor ON (o.order_id = mor.order_id) |
||
| 169 | LEFT JOIN {$xoopsDB->prefix("martin_room")} r ON (r.room_id = mor.room_id) |
||
| 170 | LEFT JOIN {$xoopsDB->prefix("martin_hotel")} h ON (r.hotel_id = h.hotel_id) |
||
| 171 | "; |
||
| 172 | $sql .= " WHERE o.order_uid = $uid AND c.coupon_type = 1 "; |
||
| 173 | $sql .= "UNION SELECT ob.*,'注册' FROM $table ob WHERE ob.coupon_type = 2 AND ob.uid = $uid "; |
||
| 174 | $sql .= "LIMIT $start,{$xoopsModuleConfig['front_perpage']}"; |
||
| 175 | $rows = $this->GetRows($sql); |
||
| 176 | |||
| 177 | return $rows; |
||
| 178 | } |
||
| 179 | |||
| 180 | /** |
||
| 181 | * @get order hotels |
||
| 182 | * @method: |
||
| 183 | * @license http://www.blags.org/ |
||
| 184 | * @created :2010年07月19日 20时40分 |
||
| 185 | * @copyright 1997-2010 The Martin Group |
||
| 186 | * @author Martin <[email protected]> |
||
| 187 | * @param $order_ids |
||
| 188 | * @return array|null |
||
| 189 | */ |
||
| 190 | public function getOrderHotels($order_ids) |
||
| 191 | { |
||
| 192 | global $xoopsDB; |
||
| 193 | if (empty($order_ids)) { |
||
| 194 | return null; |
||
| 195 | } |
||
| 196 | $sql = "SELECT h.hotel_name,h.hotel_alias,h.hotel_city,mor.order_id,rt.room_type_info FROM {$xoopsDB->prefix("martin_hotel")} h "; |
||
| 197 | $sql .= "LEFT JOIN {$xoopsDB->prefix("martin_room")} r ON (r.hotel_id = h.hotel_id) "; |
||
| 198 | $sql .= "LEFT JOIN {$xoopsDB->prefix("martin_room_type")} rt ON (rt.room_type_id = r.room_type_id) "; |
||
| 199 | $sql .= "LEFT JOIN {$xoopsDB->prefix("martin_order_room")} mor ON (mor.room_id = r.room_id) "; |
||
| 200 | $sql .= "WHERE mor.order_id IN (" . implode(",", $order_ids) . ") GROUP BY mor.order_id "; |
||
| 201 | $sql .= "UNION SELECT h.hotel_name,h.hotel_alias,h.hotel_city,oqr.order_id,rt.room_type_info FROM {$xoopsDB->prefix("martin_hotel")} h "; |
||
| 202 | $sql .= "LEFT JOIN {$xoopsDB->prefix("martin_room")} r ON (r.hotel_id = h.hotel_id) "; |
||
| 203 | $sql .= "LEFT JOIN {$xoopsDB->prefix("martin_room_type")} rt ON (rt.room_type_id = r.room_type_id) "; |
||
| 204 | $sql .= "LEFT JOIN {$xoopsDB->prefix("martin_order_query_room")} oqr ON (oqr.room_id = r.room_id) "; |
||
| 205 | $sql .= "WHERE oqr.order_id IN (" . implode(",", $order_ids) . ") GROUP BY oqr.order_id "; |
||
| 206 | |||
| 207 | return $this->GetRows($sql, 'order_id'); |
||
| 208 | } |
||
| 209 | |||
| 210 | /** |
||
| 211 | * @ |
||
| 212 | * @method: |
||
| 213 | * @license http://www.blags.org/ |
||
| 214 | * @created :2010年07月19日 20时40分 |
||
| 215 | * @copyright 1997-2010 The Martin Group |
||
| 216 | * @author Martin <[email protected]> |
||
| 217 | * @param $order_id |
||
| 218 | * @param $hotel_id |
||
| 219 | * @return array |
||
| 220 | */ |
||
| 221 | public function GetOrderService($order_id, $hotel_id) |
||
| 222 | { |
||
| 223 | global $xoopsDB; |
||
| 224 | $sql = "SELECT os.*,s.*,st.*,hs.service_extra_price FROM {$xoopsDB->prefix("martin_hotel_service")} s "; |
||
| 225 | $sql .= "INNER JOIN {$xoopsDB->prefix("martin_order_service")} os ON (os.service_id = s.service_id) "; |
||
| 226 | $sql .= "INNER JOIN {$xoopsDB->prefix("martin_hotel_service_type")} st ON (st.service_type_id = s.service_type_id) "; |
||
| 227 | $sql .= "INNER JOIN {$xoopsDB->prefix("martin_hotel_service_relation")} hs ON (s.service_id = hs.service_id) "; |
||
| 228 | $sql .= "WHERE os.order_id = $order_id AND hs.hotel_id = $hotel_id "; |
||
| 229 | $sql .= "GROUP BY s.service_id"; |
||
| 230 | |||
| 231 | return $this->GetRows($sql, 'service_id'); |
||
| 232 | } |
||
| 233 | } |
||
| 234 |
Our type inference engine in quite powerful, but sometimes the code does not provide enough clues to go by. In these cases we request you to add a
@returnannotation as described here.